Good At Marketing LLC (“gocta.ai”, “we”, “us”, “our”), operator of gocta.ai, respects your privacy. This policy explains what information we handle and how. Questions: donnie@goodatmarketing.com, Good At Marketing LLC, 4278 Fox Trace Road, Boynton Beach, FL 33436.
Mobile & SMS data - our commitment: No mobile information, SMS opt-in, or SMS consent data is ever shared, sold, rented, or transferred to any third party or affiliate for marketing, promotional, or any other purpose. This includes the advertising platforms described in Section 5. See Section 6 for our full SMS terms.
1. Our two roles
- When you are our customer (you sign up for gocta.ai), we are the controller of your account information.
- When you are a lead who submits a form built by one of our customers, that customer is the controller of your information - they decide why it’s collected and how it’s used, and we act as their processor, handling it on their behalf. To exercise rights over that data, contact the business whose form you submitted. This policy still explains what we do with it.
2. Information we collect
From customers (account data): name, email, business name, login credentials (via Google Firebase Authentication), workspace and form configuration, and billing details. Payment card data is handled by Stripe; we do not store full card numbers.
From leads (form-submission data, on the customer’s behalf): the information a lead enters (e.g. name, email, phone, message), plus, for spam prevention and ad measurement: IP address, browser/user-agent, ad click identifiers (gclid, gbraid, wbraid, fbclid, ttclid, msclkid) and UTM parameters passed through the form, and the resulting email, SMS, and chat conversation history. Where SMS is enabled, we also collect the lead’s mobile number and a record of SMS opt-in (the consent text shown and the time consent was given).
Automatically: cookies and similar technologies for authentication, security, and basic analytics.
3. How we use information
To provide and operate the service: capture form submissions, filter spam, generate and send AI email, SMS, and chat replies, follow up, maintain the lightweight CRM (deal stages, notes), and - where the customer enables it - report closed-deal conversions to advertising platforms. Also for billing, account security, support, product improvement, and legal compliance.
4. AI processing
Form content and conversation messages are processed by Google’s Gemini AI to (a) score submissions for spam and (b) generate reply drafts. This processing is automated, and AI output can be imperfect. Customers control whether AI replies are enabled and can review conversations.
5. Advertising conversion tracking
Where a customer enables it, we send conversion events - including a closed deal’s value and captured ad click identifiers - to Meta (Conversions API) and Google Ads so the customer can measure and optimize their own advertising. Click identifiers are retained up to 90 days to match a closed deal back to the originating click. These conversion events contain only a closed-deal value and web ad-click identifiers. Mobile information, SMS opt-in, and SMS consent data are never included in these conversion events and are never shared with Meta, Google Ads, or any other advertising platform, third party, or affiliate - for marketing, promotional, or any other purpose.
6. SMS and text messaging
Where a customer enables SMS on their form and a lead expressly opts in (by checking the SMS consent box and providing a mobile number), we send and receive text messages on the customer’s behalf through our telecom provider, Twilio. We use the mobile number and opt-in record solely to deliver and manage that messaging - including AI-generated replies the customer enables, delivery/status handling, and honoring opt-outs.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your phone number and SMS opt-in and consent data are never sold, and are never shared with any third party or affiliate for their own or anyone else’s marketing or promotional purposes. This exclusion includes the advertising platforms described in Section 5 - mobile numbers and SMS consent data are not shared with Meta, Google Ads, or any other advertiser. We use this information only to deliver the messaging you opted into, and share it only with our telecom provider (Twilio) to carry those messages, or where required by law or to protect safety.
- Consent is required and optional to give. Opting in to SMS is never a condition of submitting a form or of any purchase. We store the exact consent language shown, the time of consent, and the number provided as the record of consent.
- Opting out and help. Reply STOP at any time to stop messages; reply HELP for help. We honor STOP immediately and cease further messages to that number. Message frequency varies. Message and data rates may apply.
7. Sub-processors we use
- Google Cloud / Firebase - hosting, database, authentication, serverless functions, and Gemini AI.
- Postmark - transactional and reply email delivery and inbound routing.
- Twilio - SMS/text message delivery, inbound routing, and A2P registration (only when the customer enables SMS).
- Stripe - subscription billing and payment processing.
- Meta and Google Ads - conversion measurement (only when the customer enables it).
We require our sub-processors to protect information consistent with this policy. A current sub-processor list is available on request.
8. How we share information
With the sub-processors above to run the service; with the customer who owns a given lead’s data; when required by law, legal process, or to protect rights, property, or safety; and in a business transfer (merger, acquisition, or asset sale) subject to this policy. We do not sell your personal information, and we do not share mobile opt-in or SMS consent data with third parties for marketing.
9. Retention
We retain account data for the life of the account and as needed for legal, tax, and accounting purposes. Lead data - including SMS numbers, consent records, and message history - is retained per the customer’s use of the service; customers may request deletion. Click identifiers are retained up to 90 days for conversion matching.
10. Your rights
Depending on your location (e.g. GDPR/UK GDPR, CCPA/CPRA), you may have rights to access, correct, delete, or port your data, and to object to or restrict certain processing. Customers can exercise these in-app or by contacting us. Leads should contact the business whose form they submitted (the controller); we will assist that business as their processor. We will respond to verified requests as required by applicable law.
11. Cookies
We use strictly-necessary cookies for login, sessions, and security, and limited analytics to operate and improve the service. You can control cookies through your browser; disabling necessary cookies may break core features.
12. Data location and transfers
We operate in the United States, and information may be processed in the U.S. and other countries where our sub-processors operate, with safeguards appropriate to the data and required by applicable law.
13. Security
We use commercially reasonable technical and organizational measures to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Children
The service is not directed to, and we do not knowingly collect personal information from, children under 13. If you believe a child has provided us information, contact us and we will delete it.
15. Changes
We may update this policy from time to time. We will post the new effective date, and for material changes we will provide notice to customers. Continued use after changes take effect means you accept the updated policy.
16. Contact
Good At Marketing LLC, 4278 Fox Trace Road, Boynton Beach, FL 33436 - donnie@goodatmarketing.com.